GDPR GDPR Lawful Bases for Processing 2 — Questions and Answers
Question 1: Under GDPR, is a controller generally permitted to switch from one lawful basis to another after processing has already begun?
- Yes, at any time without restriction
- No, switching lawful bases mid-processing is generally not permitted (Correct answer)
- Yes, but only if the data subject consents
- Yes, if the supervisory authority approves the switch
Correct answer: No, switching lawful bases mid-processing is generally not permitted
Controllers must identify and document the lawful basis before processing begins; retrospectively changing the basis undermines transparency and data subject rights.
Question 2: What is a Legitimate Interests Assessment (LIA) and when is it required?
- A mandatory form submitted to the supervisory authority for every processing activity
- A three-part test used to determine whether legitimate interests can be relied upon as a lawful basis (Correct answer)
- An assessment required only when processing special category data
- A DPIA alternative used for low-risk processing activities
Correct answer: A three-part test used to determine whether legitimate interests can be relied upon as a lawful basis
An LIA involves a purpose test, necessity test, and balancing test, and should be documented whenever legitimate interests under Article 6(1)(f) is the intended basis.
Question 3: When processing special categories of personal data, what must be satisfied in addition to a lawful basis under Article 6?
- Only an Article 6 basis is needed for all personal data
- An explicit exception under Article 9(2) must also apply (Correct answer)
- The data subject must always provide written consent
- The processing must be pre-registered with the supervisory authority
Correct answer: An explicit exception under Article 9(2) must also apply
Article 9 prohibits processing special category data unless one of the explicit exceptions in Article 9(2) applies, in addition to a valid Article 6 basis.
Question 4: Which of the following is NOT one of the six lawful bases listed in Article 6(1) of the GDPR?
- Consent
- Vital interests
- Public interest research (Correct answer)
- Legitimate interests
Correct answer: Public interest research
The six bases are consent, contract, legal obligation, vital interests, public task, and legitimate interests; 'public interest research' is not a standalone Article 6 basis.
Question 5: A national tax authority processes citizen financial data to carry out its statutory collection functions. Which lawful basis is most appropriate?
- Legitimate interests
- Consent
- Public task (Correct answer)
- Contract
Correct answer: Public task
Processing by public authorities performing statutory functions is governed by Article 6(1)(e), the public task basis.
Question 6: When relying on the 'legal obligation' lawful basis, what must the controller be able to demonstrate?
- That processing is based on EU law or the law of a Member State to which the controller is subject (Correct answer)
- That the data subject has agreed to the underlying legal obligation
- That the processing is commercially necessary to meet the obligation
- That a data protection authority has approved the specific legal obligation
Correct answer: That processing is based on EU law or the law of a Member State to which the controller is subject
Article 6(3) requires that the legal obligation must be laid down by Union or Member State law applicable to the controller.
Question 7: An employer processes employee health data specifically because occupational safety legislation requires medical fitness assessments. Which Article 6 lawful basis is most applicable?
- Consent
- Legitimate interests
- Legal obligation (Correct answer)
- Contract
Correct answer: Legal obligation
Where a specific law mandates health data processing, Article 6(1)(c) (legal obligation) is the correct basis, rather than consent or contract.
GDPR GDPR Lawful Bases for Processing 2
Under GDPR, is a controller generally permitted to switch from one lawful basis to another after processing has already begun?